Methods and apparatus to collect and process browsing history

ABSTRACT

Methods and apparatus to collect and process browsing history are disclosed. One disclosed method of collecting browsing history includes collecting a plurality of web requests, and for a web request in the plurality of web requests, determining a count indicating a number of other ones of the plurality of web requests that include a referrer identifying the web request. The method also includes when the count meets a threshold, indicating that the web request is a parent web request.

RELATED APPLICATIONS

This patent is continuation of U.S. patent application Ser. No.15/402,868, which was filed on Jan. 10, 2017, and which claims priorityto Russian Patent Application No. 2016124630, which was filed on Jun.21, 2016. U.S. patent application Ser. No. 15/402,868, and RussianPatent Application No. 2016124630 are hereby incorporated herein byreference in their entireties.

FIELD OF THE DISCLOSURE

This disclosure relates generally to browser history collection, and,more particularly, to methods and apparatus to collect and processbrowsing history.

BACKGROUND

Entities that advertise their products or services on the Internet,advertising agencies, etc. have an interest in determining how users areexposed to (e.g., consume) advertisements, which are, for example,located on Internet websites and referenced via Hypertext transportprotocol (HTTP) requests. Audience monitoring can be achieved in anumber of ways. For example, monitoring can be performed at theclient-side to monitor user activities. Alternatively, monitoring can beperformed at the server-side to track and/or count served webpages.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating an example environment, in whichan example web browsing data collection may operate to collect browsinghistory of an example hardware device platform as disclosed herein.

FIG. 2 is a block diagram of an example implementation of the exampleweb browser analyzer of FIG. 1 in accordance with the teachings of thisdisclosure.

FIG. 3 is a flowchart representative of example machine readableinstructions for implementing the example web browser analyzer of FIG.2.

FIG. 4 is a schematic overview to illustrate an example operation of theexample web browser analyzer of FIG. 1 and/or FIG. 2.

FIG. 5 is a block diagram of an example processor platform capable ofexecuting machine readable instructions to implement the process of FIG.3.

The figures are not to scale. Wherever possible, the same referencenumbers will be used throughout the drawing(s) and accompanying writtendescription to refer to the same or like parts.

DETAILED DESCRIPTION

Methods and apparatus to collect and process browsing history aredisclosed herein. Network monitoring is used to determine howusers/consumers are exposed to advertising. Network monitoring can beaccomplished by monitoring activity related to a web browser and/oraccessing a browsing history from the web browser. However, web browserinformation (e.g., web browser histories) may not always be accessible(e.g., due to restrictions imposed by an operating system, encryption ofhistory information, etc.).

Typically, when a web browser installed on a client device (e.g., acomputing device such as a desktop computer, a laptop computer, or aportable device, etc.) requests a webpage (e.g., after a user inputs arequest for www.samplewebpage.com/news/index.htm), the browser willreceive a response (e.g., from a web server) that includes a webpage(e.g., a hyper-text markup language (HTML) webpage). The webpagetypically includes references to many other elements (e.g., images,videos, other webpages (e.g., in an IFRAME), etc.). As the browserprocesses the references, the browser transmits requests (e.g., HTTPrequests) to the web server (or another web server) for the elements andreceives responses that include the elements.

Most browsers keep a history of the webpages that were requested. Oftensuch a history does not identify the individual elements of the webpages(e.g., the browser history would record thatwww.samplewebpage.com/news/index.htm was visited and would not recordthe individual requests for elements (e.g., images on the webpage) ofindex.htm in the browser history). In some audience measurement systems,the browser history is collected and analyzed (e.g., transmitted to anaudience measurement entity for analysis). However, in some instances,it may not be desirable or even possible to collect the browser history.For example, some mobile devices do not allow audience measuremententity metering software to access the browser history.

Methods and apparatus disclosed herein create a history of webpagebrowsing that may be similar to the browser history collected by abrowser. Some disclosed examples collect requests transmitted by abrowser and responses received by the browser. In such examples, therequests and the responses include the requests/responses for theinitial webpage (sometimes referred to as the parent webpage) and therequests/responses for the elements of the webpage (sometimes referredto as child elements). Thus, collecting the requests/responses does notprovide a record of the requested webpages (e.g., a record of the parentwebpages).

In examples disclosed herein, a browser history is generated withoutdirectly accessing information and/or application files associated witha browser application (e.g., a stored browser history of a computingdevice). In some disclosed examples, web requests/responses (e.g.,webpage request, HTTP requests, requests/responses collected by avirtual private networking server, requests/responses collected by aproxy server, requests/responses collected by a packet capture, entriesin the “ACCEPT” headers of HTTP requests, etc.) are collected andtransformed the into a history of the web requests (e.g., the parentrequests). In some examples, the web requests are analyzed to determine,for each web request, a number of other web requests that include areference (e.g., an HTTP REFFERER field, usually referred to as aREFERER (sic) field) that identifies a webpage associated with theanalyzed web request (e.g., identifies a webpage that caused to a webbrowser to retrieve the webpage or element identified in the analyzedwebpage request). The number of references associated with each webrequest is determined. The number of references for each web request iscompared to a threshold. When the number of references exceeds or meetsthe threshold, the webpage associated with the web request that meets orexceeds the threshold may be determined to be identified (e.g., may beidentified as a candidate parent, may be inserted into a generatedbrowsing history, may be transmitted to a collection facility, etc.).

In some examples, further analysis and/or filtering of the candidateparent(s) may be performed. For example, the number of references for acandidate parent may be compared to the number of references for othercandidate parents (e.g., number of references may be compared to theroot mean square of the number of references from all other candidateparents and/or other web requests) to further filter the list ofcandidate parents down to the candidate parents that are expected to bewebpages that were requested by a user (e.g., by a typing a URL, byselecting a hyperlink, etc.).

FIG. 1 is a block diagram of an example environment 100 in which anexample web browsing data collection system may operate to collect webbrowsing history of an example hardware device platform 102 as disclosedherein. The example environment 100 includes the example hardware deviceplatform 102, which includes an example web browser application 104,example other application(s) 106 and an example web browser analyzer 108(e.g., an on-device meter). The example environment 100 also includes anexample network 110 and an example collection facility 112.

The example hardware device platform 102 may be a desktop computer, alaptop, a portable device (e.g., a tablet or cell phone), or adistributed computing system (e.g., a collection of computing devicesthat run web browsers). In this example, a processor of the hardwaredevice platform 102 executes the web browser application 104 in parallelwith the web browser analyzer 108 and/or the other application(s) 106.While the illustrated example of FIG. 1 includes a single hardwaredevice platform 102, any number of hardware device platforms 102 may bepresent in the environment 100. For example, the example collectionfacility 112 may collect analyzed data from many hardware deviceplatforms 102 that are associated with many users to generatestatistical reports that reflect exposure of a total audience towebpages or other needs.

The web browser application 104 of the illustrated example is anapplication running on the example hardware device platform 102. Inparticular, the example web browser application 104 is operated toaccess webpages via the network 110. However, the example web browserapplication 104 may be any application (e.g., an application thatutilizes HTTP requests but does not generally function as a web browsingapplication) or portal used to access the network 110. For example, theweb browser application 104 may be an application used to retrievesports scores, an application that presents videos, etc.).

The other applications(s) 106 of the illustrated example run on thehardware device platform 102. In particular the other application(s) 106of the illustrated example run in parallel with the web browserapplication 104 (e.g., in a multithreaded computing environment of thehardware device platform 102). According to the illustrated example, theother application(s) 106 access the network 110 directly. However, inother examples, the other application(s) 106 may access the network 110via the web browser analyzer 108. In such examples, the web browseranalyzer 108 may also analyze HTTP requests/traffic from at least aportion of the other application(s) 106.

The web browser analyzer 108 of the illustrated example is aprogram/process/application that runs on the hardware device platform102. For example, the web browser analyzer 108 runs in parallel with theweb browser application 104 and/or the other application(s) 106.Alternatively, the web browser analyzer 108 may be executed and/orlocated with any other device. For example, the web browser analyzer 108may be a stand-alone device that is connected to the example network 110and located at the same location as the example collection facility 112,or any other location.

The example web browser analyzer 108 of FIG. 1 is implemented as avirtual private network (VPN) server (e.g., an on-device VPN server, amobile device VPN server, etc.). According to the illustrated example,the web browser analyzer 108 logs HTTP data from the web browserapplication 104 and forwards the HTTP data to the network 110,collection facility 112 by using a data packet analyzer in which HTTPdata is parsed and/or transmission control protocol (TCP) streams arere-assembled. According to the illustrated example, the TCP streams arereassembled and analyzed at the example web browser analyzer 108executing on the hardware device platform 102. Alternatively, the TCPstreams may be forwarded to the network 110 and/or the data collectionfacility 112 for analysis. The TCP streams may use protocols such asIPv4, IPv6, or any other appropriate protocol. While the web browseranalyzer 108 is a VPN server that collects packets and analyzes them togenerate a list of webpage requests and/or responses, the web browseranalyzer 108 may alternatively be implemented by any software and/ordevice that determines web requests sent by the browser application 106and/or the other application(s) 106. For example, the web browseranalyzer 108 may be a packet sniffer, a proxy server, a router, anetwork switch, an application or device with a programming interface tothe web browser application 104 and/or the hardware device platform 102,etc.

The network 110 of the illustrated example is the internet.Alternatively, the network 110 may be a wireless network, a wirednetwork, a TCP/IP network, a wide access network (WAN), a local accessnetwork (LAN), or any appropriate combination of the aforementioned orother network types.

The collection facility 112 of the illustrated example iscommunicatively coupled to the example hardware device platform 102 (andthereby the web browser analyzer 108) via the network 110 to collectdata (e.g., browsing data for collected advertising analysis purposes)from multiple ones of the hardware device platforms 102. In thisexample, the collection facility 112 consists of one or more servers tocollect, aggregate and/or analyze the data collected from the multiplehardware device platforms (e.g., to generate reports of webpageexposure, etc.).

In operation, to collect browsing information of the hardware deviceplatform 102, the web browser analyzer 108 of the illustrated exampleacts as an intermediary between the web browser application 104 and thenetwork 110 (e.g., web servers are accessible via the network 110), aswill be discussed in greater detail below in connection with FIG. 2. Inparticular, the example web browser analyzer 108 of FIG. 1 monitorsbrowser requests from the example web browser application 104 togenerate a browsing history (e.g., a browsing history of webpagesrequested by a user of the example hardware device platform 102). Togenerate the browser history that represents a webpage requested by auser (e.g., to filter web elements that form the webpages requested bythe user (such as images, videos, scripts, etc.)), the web browseranalyzer 108 counts the number of references identifying each webrequest (e.g., counts the number of other web requests that include aREFERER filed that identifies the web request). The web browser analyzer108 compares the number of references to one or more thresholds or othermetrics to determine if the web request is determined to be a webrequest for a requested webpage or, alternatively, a request for a childelement. The browsing history information (e.g., the webpages identifiedas parent webpages) is then provided/forwarded to the collectionfacility 112.

FIG. 2 is a block diagram of an example implementation of the exampleweb browser analyzer 108 of FIG. 1 in accordance with the teachings ofthis disclosure. The web browser analyzer 108 of the illustrated exampleincludes an example packet capturer 202, an example reference/referreranalyzer 204, an example threshold/filter analyzer 206 and an exampletransmitter/encoder 208. The example web browser analyzer 108 alsoincludes a storage 212 (e.g., a database, a buffer, a cache, file,etc.).

The packet capturer 202 of the illustrated example receives web traffic(e.g., HTTP requests, HTML files, webpage data, packets and/or web datafiles/requests) related to the web browser application 104 of FIG. 1.Additionally or alternatively, the packet capturer 202 may receivetraffic from any other application or device. In this example, thepacket capturer 202 receives web request data from the web browserapplication 104. The example packet capturer 202 forwards received datato the example reference/referrer analyzer 204.

The reference/referrer analyzer 204 of the illustrated example processesweb requests received from the example packet capturer 202 to determineif at least one of the plurality of web requests (e.g., a collection ofweb requests) may be a candidate parent (e.g., a parent webpagerequested by a user). In some examples, the reference/referrer analyzer204 stores at least some of the web requests and/or candidate parent(s)in the example storage 212. For example, the reference/referrer analyzerextracts web requests (e.g., from HTTP traffic, from data transmittedand/or received the web browser application 104 and/or the otherapplication(s) 106, etc.) and processes the web requests to determinereferrer counts corresponding to the web requests (e.g., associatedwebpages). The example packet capturer 202, in turn, forwards thereferrer counts to the example threshold/filter analyzer 206 afterdetermining the referrer counts. In this illustrated example, the packetcapturer 202 forwards the referrer counts with respective candidateparents. In particular, the web requests are denoted as candidateparents in this example when they are forwarded to the threshold/filteranalyzer 206 along with the referrer counts. An example of how areferrer (“Referer” (sic)) is embedded in HTML code of a web request isseen in Table 1 below:

TABLE 1 GET /images/header.gif Accept: image/gif, image/jpeg, */*Referer: http://www.webserver.com/homepage.html Accept-Language: en-usAccept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE6.0; Windows NT 5.1) Host: webserver.com:80 Connection: Keep-Alive

The threshold/filter analyzer 206 of the illustrated example filters thecandidate parent(s) and/or further analyzes the candidate parent(s) todetermine a final list (e.g., array) of parents (e.g., winner parents).In this example, the threshold/filter analyzer 206 sorts and/or discardsthe candidate parent(s). According to the illustrated example, thethreshold/filter analyzer 206 compares the referrer counts associatedwith the candidate parent(s) to a threshold. The examplethreshold/filter analyzer forwards the candidate parent(s) that haverespective referrer counts that meet or exceed the threshold.Accordingly, in this example, the candidate parent(s) that do not haverespective referer counts that meet or exceed the threshold arediscarded.

The transmitter/encoder 208 of the illustrated example transmits dataincluding the final list of parents to the collection facility 112 viathe network 110. In this example, the transmitter/encoder 208 acts as anencoding device that transmits the final list of parents (e.g.,encapsulated as packets) to the network 110.

In this example, the storage 212 is a storage device for (at leasttemporarily) storing the candidate parent(s), winner parents, and/or anyassociated arrays of the candidate parent(s). In particular, the storage212 may store candidate parent(s) and/or web requests (e.g., from thepacket capturer 202). The storage 212 may be implemented as non-volatilerandom access memory (NVRAM), flash memory, a buffer, a cache, a fileand/or a storage device such as a hard drive or other storage media,etc.

While an example manner of implementing the example web browser analyzer108 of FIG. 1 is illustrated in FIG. 2, one or more of the elements,processes and/or devices illustrated in FIG. 2 may be combined, divided,re-arranged, omitted, eliminated and/or implemented in any other way.Further, the example packet capturer 202, the example reference/referreranalyzer 204, the example threshold/filter analyzer 206, the exampletransmitter/encoder 208, the example storage 212 and/or, more generally,the example web browser analyzer 108 of FIG. 1 may be implemented byhardware, software, firmware and/or any combination of hardware,software and/or firmware. Thus, for example, any of the example packetcapturer 202, the example reference/referrer analyzer 204, the examplethreshold/filter analyzer 206, the example transmitter/encoder 208, theexample storage 212 and/or, more generally, the example web browseranalyzer 108 could be implemented by one or more analog or digitalcircuit(s), logic circuits, programmable processor(s), applicationspecific integrated circuit(s) (ASIC(s)), programmable logic device(s)(PLD(s)) and/or field programmable logic device(s) (FPLD(s)). Whenreading any of the apparatus or system claims of this patent to cover apurely software and/or firmware implementation, at least one of theexample, packet capturer 202, the example reference/referrer analyzer204, the example threshold/filter analyzer 206, the exampletransmitter/encoder 208, and/or the example storage 212 is/are herebyexpressly defined to include a tangible computer readable storage deviceor storage disk such as a memory, a digital versatile disk (DVD), acompact disk (CD), a Blu-ray disk, etc. storing the software and/orfirmware. Further still, the example the example web browser analyzer108 of FIG. 1 may include one or more elements, processes and/or devicesin addition to, or instead of, those illustrated in FIG. 2, and/or mayinclude more than one of any or all of the illustrated elements,processes and devices.

A flowchart representative of example machine readable instructions thatmay be executed implement the example web browser analyzer 108 of FIG. 1and/or FIG. 2 is shown in FIG. 3. In this example, the machine readableinstructions comprise a program for execution by a processor such as theprocessor 512 shown in the example processor platform 500 discussedbelow in connection with FIG. 5. The program may be embodied in softwarestored on a tangible computer readable storage medium such as a CD-ROM,a floppy disk, a hard drive, a digital versatile disk (DVD), a Blu-raydisk, or a memory associated with the processor 512, but the entireprogram and/or parts thereof could alternatively be executed by a deviceother than the processor 512 and/or embodied in firmware or dedicatedhardware. Further, although the example program is described withreference to the flowchart illustrated in FIG. 3, many other methods ofimplementing the example web browser analyzer 108 may alternatively beused. For example, the order of execution of the blocks may be changed,and/or some of the blocks described may be changed, eliminated, orcombined.

As mentioned above, the example process of FIG. 3 may be implementedusing coded instructions (e.g., computer and/or machine readableinstructions) stored on a tangible computer readable storage medium suchas a hard disk drive, a flash memory, a read-only memory (ROM), acompact disk (CD), a digital versatile disk (DVD), a cache, arandom-access memory (RAM) and/or any other storage device or storagedisk in which information is stored for any duration (e.g., for extendedtime periods, permanently, for brief instances, for temporarilybuffering, and/or for caching of the information). As used herein, theterm tangible computer readable storage medium is expressly defined toinclude any type of computer readable storage device and/or storage diskand to exclude propagating signals and to exclude transmission media. Asused herein, “tangible computer readable storage medium” and “tangiblemachine readable storage medium” are used interchangeably. Additionallyor alternatively, the example process of FIG. 3 may be implemented usingcoded instructions (e.g., computer and/or machine readable instructions)stored on a non-transitory computer and/or machine readable medium suchas a hard disk drive, a flash memory, a read-only memory, a compactdisk, a digital versatile disk, a cache, a random-access memory and/orany other storage device or storage disk in which information is storedfor any duration (e.g., for extended time periods, permanently, forbrief instances, for temporarily buffering, and/or for caching of theinformation). As used herein, the term non-transitory computer readablemedium is expressly defined to include any type of computer readablestorage device and/or storage disk and to exclude propagating signalsand to exclude transmission media. As used herein, when the phrase “atleast” is used as the transition term in a preamble of a claim, it isopen-ended in the same manner as the term “comprising” is open ended.

The example process 300 of FIG. 3 begins when the example hardwaredevice platform 102 (e.g., a mobile phone, tablet, a computer, a laptop,a distributed computing system, desktop computer etc.) is used to browsewebpage(s) using the web browser application 104. In the illustratedexample, access to the browser history of the web browser application104 is prevented.

The example packet capturer 202 captures/collects a plurality of webrequests (e.g., 10, 20, 50, 100, etc. web requests) that are transmittedby the example web browser application 104 (block 302). In particular,the web requests collected by the packet capturer 202 are related to themultiple webpages accessed on the web browser application 104 of thehardware device platform 102 (e.g., accessed within a defined timeduration and/or a pattern of activity such as multiple web requests ofthe web browser application 104). In this example, a number of thecollected web requests is based on a defined number (e.g., only 10, 20,30, 40 . . . collected web requests are stored, etc.). For example,according to the illustrated example, 20 web requests are collected bythe packet capturer 202 during a specific time period/time step. In thisexample, a VPN server of the web browser analyzer 108 is used to collectweb requests/HTTP requests from the web browser application 104.

For a web request of the plurality of web requests, the examplereference/referrer analyzer 204 determines a number (e.g., a count) ofother web requests that include a referrer identifying the web request(block 304). In some examples, the referrer counting is performed by theexample reference/referrer analyzer 204 iterating (e.g., sequentiallyiterating) through the stored web requests. In other examples, each ofthe web requests are analyzed to determine referrer counts in parallel(e.g., a multithreaded operation). For example, referrer counts of eachof the webpage responses may be determined after the web requests and/orHTTP requests are parsed out to separate reference/referrer analyzers204 via separate buffers/caches. Additionally or alternatively, theexample reference/referrer analyzer 204 performs an ongoing count ofreferrer counts (e.g., using counters associated with each request).

Next, in this example, the threshold/filter analyzer 206 determineswhether the referrer count/number of a web request (and associatedwebpage) meets or exceeds a threshold (block 306). In particular, thethreshold/filter analyzer 206 compares the number of Referer fields ofweb requests that refer to the web request to a threshold. The thresholdmay be periodically refined based on incoming collections of webrequests (e.g., the threshold may be increased or decreased). Accordingto the illustrated example, the referrer count may be compared to a rootmean square of the other referrer counts corresponding to other webrequests (e.g., other web requests of a collected group of webrequests). An example of this determination is described in greaterdetail below in connection with FIG. 4. In some other examples, thethreshold is additionally or alternatively a numerical value (e.g., aconstant numerical value such as 5, 10, 15, etc.). If the web requestdoes not meet or exceed the threshold (block 306), the process returnscontrol to block 304 to process a next web request, otherwise theprocess proceeds to block 308.

When the threshold/filter analyzer 206 determines that the number ofreferrers referring to the web request meets the threshold (block 306),the corresponding web request and/or a webpage associated with thecorresponding web request is deemed a candidate (e.g., a candidateparent) (block 308).

In some examples, the threshold/filter analyzer 206 determines whetherthe candidate passes a filter (block 310). For example, the candidatemay be filtered by the threshold/filter analyzer 206 to remove certainweb request types such as IFRAMES, pop-up windows, and/or knownadvertising, etc. that are requested by the web browser application 104,for example. Additionally or alternatively, the web requests arefiltered by the threshold/filter analyzer 206 prior to thereference/referrer analyzer 204 determining whether any of the pluralityof web requests are a candidate. In some examples, the candidate isfiltered by the threshold/filter analyzer 206 against a blacklist (e.g.,a list of web requests, domain names and/or webpages to be filtered outof consideration). Additionally or alternatively, the candidate may befiltered by the threshold/filter analyzer 206 based on certain types ofweb requests (e.g., an HTML frame request, an in-page request, a script,a cascading style sheet (CSS) request, a ping and/or pop-up request,etc.). If the candidate passes the filter (block 310), the processproceeds to block 312. Otherwise, control of the process returns toblock 304 to process a next web request, for example.

In this example, the threshold/filter analyzer 206 places the candidateinto an array (e.g., a data array) after the candidate has passed thefilter performed by the threshold/filter analyzer 206 (block 312). Inparticular, the array of the illustrated example prevents a duplicatefinding of the candidate during a defined time duration (e.g., 2seconds, 20 seconds, 200 seconds, etc.). In some examples, the array isstored in the example storage 212.

The example threshold/filter analyzer 206 of the illustrated exampledetermines if the at least one candidate has been kept in the array fora specific duration and/or time threshold (block 314). For example, thepacket capturer 202 may provide newer candidate(s) to replace thecandidate and/or other candidates in the array (e.g., temporarily storedin the storage 212) during this specific time duration. If it isdetermined that the candidate has not been in the array for the specifictime duration (block 314), the process verifies that the time duration(block 315) has been met and the process returns control to the block314. Otherwise, the process proceeds to block 316.

After the time duration has been met (block 315), thetransmitter/encoder 208 outputs the candidate to the collection facility112 via the network 110 for further analysis and/or data aggregation(block 316). Additionally or alternatively, the transmitter/encoder 208provides a webpage and/or a URL associated with the candidate as anoutput. In some examples, the web request is transmitted as anencapsulated data packet identifying the web request as an entry for thefinal list (e.g., a winner web request).

In some examples, the process 300 of FIG. 3 may repeat upon a need toprocess other web requests, new subsequent browser activity and/oradditional web requests to be processed. In this example, the packetcapturer 202 determines whether the process is to be repeated for otherweb requests (e.g., based on a number or characteristic of incoming webrequests from the web browser application 104) (block 318) and if theweb browser analyzer 108 determines that the process is to be repeated(block 318), control returns to block 304. Otherwise, the process ends.In some examples, whether the process ends is determined based on howmany web requests are to be analyzed by the reference/referrer analyzer204. In particular, one of the web requests may be selected at a time bythe packet capturer 202 and/or the reference/referrer analyzer 204 todetermine respective referrer counts, and when the web requests (e.g.,stored web requests in the storage 212) are analyzed for referrercounts, the process ends. Additionally or alternatively, the processrepeats based on collecting a new set of a plurality of web requestsand/or a subsequent web request.

FIG. 4 is a schematic overview illustrating a result of the exampleprocess 300 of FIG. 3. More specifically, the example of FIG. 4corresponds to a specific time period (e.g., a time period where aspecific number of web requests are collected) and/or time step of theexample method 300 of FIG. 3. At this time period, numerous example webpage requests 402A-402L have been stored (e.g., stored in the examplestorage 212). In this example, the number of collected web requestsdefines when the example process is initiated. Each of the example webrequests 402 has a corresponding webpage element 404 and/or webpage(e.g., a webpage or other resource such as an image) that was accessedas well as a corresponding referrer 406. In this example, the exampleweb request 402C corresponds to a request for the default webpage fromthe domain sample. com. In this example, a total number of 10 webrequests 402A-402L are captured as a collection.

As can be seen in the example of FIG. 4, the example web request 402Chas a corresponding total referrer count 410C of 5 other referrers fromthe other web page requests 402A, 402B, 402E, 402F and 402G. Similarly,the example web request 402F for A.com/a.js has a total referrer count410F of 2 referrers (from the example webpage requests 402D and 402H)while the example web request 402G for B.com/frame.html and the exampleweb request 402E for C.com/image.gif each have one referrer. In thisexample, a web request and/or a webpage associated with the web requestare deemed to be a candidate if their associated referrer count exceeds(or meets) a threshold of 4 the calculated root mean square of referrercounts of the other collected web requests (e.g., currently collectedweb requests of this timeframe) with their respective webpages. Within agiven collection, a plurality of candidates may be determined (e.g., bythe reference/referrer analyzer 204). In the example calculation ofEquation 1, which may be performed by the example threshold/filteranalyzer 206, is shown below:

$\begin{matrix}{{{Referrers}\mspace{14mu}{for}\mspace{14mu}{the}\mspace{14mu}{web}\mspace{14mu}{request}{\mspace{14mu}\;}204} = {{5 > \sqrt{2^{2} + 1^{2} + 1^{2} + 1^{2}}} = {{2.6}45}}} & (1)\end{matrix}$

Because the referrer count 410C of the web request 402C (5) exceeds thethreshold of four and the root mean square of the other referrer counts(2.645), the web request 402C of the illustrated example is deemed acandidate parent. In some examples, a web request may be deemed a parentif the number of referrers meets or exceed the threshold or root meansquare.

Because the example web request 402C has been deemed a candidate, theexample web request 402C of the illustrated example and/or itsrespective associated website (sample.com) is placed into an examplearray 430, which may be stored in the example storage 212. The array 430of the illustrated example prevents the web request 402C and/or itsrespective website from being duplicated within the array 430. In someexamples, the web request 402C is filtered by the threshold/filteranalyzer 206 prior to being placed within the array 430. In someexamples, the web request 402C is replaced within the array 430 by asubsequent web request with a higher number of referrers. In someexamples, the web request 402C is held in the array 430 until a definedtime duration after the latest record/candidate is received (e.g., 10seconds). In some examples, candidates within the array 430 areeventually discarded (e.g., pushed out based on the time placed in thearray 430) after a defined time duration.

FIG. 5 is a block diagram of an example processor platform 500 capableof executing the instructions of FIG. 3 to implement the web browseranalyzer 108 of FIGS. 1 and 2. The processor platform 500 can be, forexample, a server, a personal computer, a mobile device (e.g., a cellphone, a smart phone, a tablet such as an iPad™), a personal digitalassistant (PDA), an Internet appliance, a DVD player, a CD player, adigital video recorder, a Blu-ray player, a gaming console, a personalvideo recorder, a set top box, or any other type of computing device.

The processor platform 500 of the illustrated example includes aprocessor 512. The processor 512 of the illustrated example is hardware.For example, the processor 512 can be implemented by one or moreintegrated circuits, logic circuits, microprocessors or controllers fromany desired family or manufacturer.

The processor 512 of the illustrated example includes a local memory 513(e.g., a cache). In this example, the processor 512 also includes theexample packet capturer 202, the example reference/referrer analyzer204, the example threshold/filter analyzer 206 and the exampletransmitter/encoder 208. The processor 512 of the illustrated example isin communication with a main memory including a volatile memory 514 anda non-volatile memory 516 via a bus 518. The volatile memory 514 may beimplemented by Synchronous Dynamic Random Access Memory (SDRAM), DynamicRandom Access Memory (DRAM), RAMBUS Dynamic Random Access Memory (RDRAM)and/or any other type of random access memory device. The non-volatilememory 516 may be implemented by flash memory and/or any other desiredtype of memory device. Access to the main memory 514, 516 is controlledby a memory controller.

The processor platform 500 of the illustrated example also includes aninterface circuit 520. The interface circuit 520 may be implemented byany type of interface standard, such as an Ethernet interface, auniversal serial bus (USB), and/or a PCI express interface.

In the illustrated example, one or more input devices 522 are connectedto the interface circuit 520. The input device(s) 522 permit(s) a userto enter data and commands into the processor 512. The input device(s)can be implemented by, for example, an audio sensor, a microphone, acamera (still or video), a keyboard, a button, a mouse, a touchscreen, atrack-pad, a trackball, isopoint and/or a voice recognition system.

One or more output devices 524 are also connected to the interfacecircuit 520 of the illustrated example. The output devices 524 can beimplemented, for example, by display devices (e.g., a light emittingdiode (LED), an organic light emitting diode (OLED), a liquid crystaldisplay, a cathode ray tube display (CRT), a touchscreen, a tactileoutput device, a printer and/or speakers). The interface circuit 520 ofthe illustrated example, thus, typically includes a graphics drivercard, a graphics driver chip or a graphics driver processor.

The interface circuit 520 of the illustrated example also includes acommunication device such as a transmitter, a receiver, a transceiver, amodem and/or network interface card to facilitate exchange of data withexternal machines (e.g., computing devices of any kind) via a network526 (e.g., an Ethernet connection, a digital subscriber line (DSL), atelephone line, coaxial cable, a cellular telephone system, etc.).

The processor platform 500 of the illustrated example also includes oneor more mass storage devices 528 for storing software and/or data.Examples of such mass storage devices 528 include floppy disk drives,hard drive disks, compact disk drives, Blu-ray disk drives, RAIDsystems, and digital versatile disk (DVD) drives.

The coded instructions 532 of FIG. 3 may be stored in the mass storagedevice 528, in the volatile memory 514, in the non-volatile memory 516,and/or on a removable tangible computer readable storage medium such asa CD or DVD.

From the foregoing, it will be appreciated that the above disclosedmethods, apparatus and articles of manufacture enable an efficientmanner of determining and/or generating a browser history (e.g., abrowser history of a portable device) without accessing browserinformation (e.g., browser data files, browser histories, etc.).

This patent claims priority to Russian Patent Application No.2016124630, which was filed on Jun. 21, 2016. The foregoing RussianPatent Application is hereby incorporated herein by reference in itsentirety.

Although certain example methods, apparatus and articles of manufacturehave been disclosed herein, the scope of coverage of this patent is notlimited thereto. On the contrary, this patent covers all methods,apparatus and articles of manufacture fairly falling within the scope ofthe claims of this patent.

What is claimed is:
 1. An apparatus comprising: at least one memory;instructions in the apparatus; and processor circuitry to execute theinstructions to: determine a number of referrers corresponding torespective web requests of a plurality of web requests associated with aweb application based on Hypertext Transfer Protocol (HTTP) dataassociated with the plurality of web requests, log the HTTP dataassociated with the plurality of web requests, hold ones of theplurality of web requests for a defined time duration, wherein ones ofthe web requests older than the time duration are discarded, identify aweb request of the plurality of web requests that has a respectivenumber of referrers that exceeds a threshold as a parent web requestbased on the HTTP data, the threshold calculated for a web request ofthe plurality of web requests based on referrer counts corresponding toother web requests of the plurality of web requests, and provide auniform resource locator (URL) of the parent request.
 2. The apparatusas defined in claim 1, wherein the processor circuitry is to filter aweb request that has a respective number of referrers meeting thethreshold.
 3. The apparatus as defined in claim 2, wherein the processorcircuitry is to filter the web request based on detection of at leastone of an in-page request, a script, a cascading style sheet (CSS)request, or a ping.
 4. The apparatus as defined in claim 1, wherein theprocessor circuitry is to place ones of the web requests having numbersof referrers that meet the threshold into an array of the ones of theplurality of web requests, wherein the array is to be updated based onlater incoming web requests having a greater number of respective numberof referrers than the web request.
 5. The apparatus as defined in claim1, wherein the processor circuitry is to remove a web request of theplurality of web requests that has a respective number of referrers thatdo not meet the threshold.
 6. The apparatus as defined in claim 1,wherein the web application is to be executed on a first thread of afirst processor, and wherein the instructions are to be executed on asecond thread different from the first thread.
 7. The apparatus asdefined in claim 6, wherein the second thread is executed on a secondprocessor separate from the first processor.
 8. A method of determiningbrowsing history of a web application, the method comprising:collecting, by executing instructions with at least one processor, aplurality of web requests associated with a web application based onHypertext Transfer Protocol (HTTP) data associated with the plurality ofweb requests; logging, by executing instructions with the at least oneprocessor, the HTTP data associated with the plurality of web requests;holding, by executing instructions with the at least one processor, onesof the plurality of web requests for a defined time duration, whereinones of the web requests older than the time duration are discarded, fora web request in the plurality of web requests, determining, byexecuting instructions with the at least one processor, a countindicating a number of other ones of the plurality of web requests thatinclude a referrer identifying the web request based on the HTTP data;and in response to the count exceeding a threshold, providing, byexecuting instructions with the at least one processor, a uniformresource locator (URL) of a parent web request.
 9. The method as definedin claim 8, further including filtering, by executing instructions withthe at least one processor, the web requests having a respective countthat meets or is above the threshold.
 10. The method as defined in claim9, wherein the filtering of the web requests is based on detection of atleast one of an in-page request, a script, a cascading style sheet(CSS), or a ping.
 11. The method as defined in claim 8, furtherincluding adding, by executing instructions with the at least oneprocessor, web requests that have respective counts greater than thethreshold to the plurality of web requests.
 12. The method as defined inclaim 8, further including removing, by executing instructions with theat least one processor, at least one web request from an array of theones of the plurality of web requests based on later incoming webrequests into the array having respective counts greater than thethreshold.
 13. The method as defined in claim 8, further includingremoving, by executing instructions with the at least one processor, theleast one web request from the plurality of web requests based on alater received web request having a respective number of referrer countsexceeding a referrer count corresponding to the least one web request.14. The method as defined in claim 8, further including discarding, byexecuting instructions with the at least one processor, a web request ofthe plurality of web requests that is not determined to be a parent webrequest.
 15. The method as defined in claim 8, wherein the webapplication is executed on a first thread of a first processor of afirst device and the instructions are executed on a second thread of asecond processor of a second device different from the first device. 16.The method as defined in claim 8, further including discarding a webrequest of the plurality of collected web requests with a respectivereferrer count that does not meet the threshold.
 17. A non-transitorymachine readable medium comprising instructions, which when executed,cause at least one processor to at least: determine a number ofreferrers corresponding to respective web requests of a plurality of webrequests associated with a web application based on Hypertext TransferProtocol (HTTP) data associated with the plurality of web requests; logthe HTTP data associated with the plurality of web request; hold ones ofthe plurality of web requests for a defined time duration, wherein onesof the web requests older than the time duration are discarded; identifya web request of the plurality of web requests that has a respectivenumber of referrers that exceeds a threshold as a parent web requestbased on the HTTP data, the threshold calculated for a web request ofthe plurality of web requests; and provide a uniform resource locator(URL) of the parent web request.
 18. The machine readable medium asdefined in claim 17, wherein the instructions further cause the at leastone processor to filter a web request that has a respective number ofreferrers meeting the threshold.
 19. The machine readable medium asdefined in claim 18, wherein the web request is filtered based ondetection of at least one of an in-page request, a script, a cascadingstyle sheet (CSS) request, or a ping.
 20. The machine readable medium asdefined in claim 17, wherein the instructions further cause the at leastone processor to update an array of the ones of the plurality of webrequests based on later incoming web requests having a greater number ofrespective number of referrers than the web request.
 21. The machinereadable medium as defined in claim 17, wherein the instructions furthercause the at least one processor to remove a web request of theplurality of web requests that has a respective number of referrers thatdo not meet the threshold.